The FOCI Problem: Why Foreign Ownership Rules Are the Defense Startup Killer Nobody Warns You About

Most defense startup founders learn about Foreign Ownership, Control, or Influence (FOCI) the hard way: after they've already taken the money.

Photo by Aseem Borkar on Pexels.

A Series A closes with a European sovereign wealth fund participating. The startup applies for a facility security clearance (FCL) to pursue a classified DoD contract. Then the Defense Counterintelligence and Security Agency (DCSA) flags the cap table, and suddenly the company is staring at months of mitigation negotiations, ballooning legal fees, and a contract opportunity that won't wait.

This happens more than the industry admits.

What FOCI Actually Is

FOCI isn't a single rule. It's a regulatory determination that a foreign interest has the ability to direct or decide matters affecting a company's management, operations, or policies in ways that could expose classified information. DCSA makes this determination when a company applies for an FCL, which is required to access classified programs, facilities, or contracts.

The factors DCSA weighs are broader than most founders expect. Foreign ownership of voting shares above 5% can trigger review. So can foreign nationals on the board, foreign loans with restrictive covenants, foreign-sourced intellectual property licenses, or even a foreign parent company with contractual rights over key personnel decisions. Any one of these, under the wrong combination of circumstances, can constitute a FOCI determination.

Once you have a FOCI determination, you have options. None of them are fast or cheap.

The Mitigation Menu

DCSA offers several mitigation instruments depending on the severity and nature of the foreign interest involved:

graph TD
    A[FOCI Determination] --> B{Severity Assessment}
    B --> C[Board Resolution]
    B --> D[Security Control Agreement]
    B --> E[Special Security Agreement]
    B --> F[Proxy Agreement or Voting Trust]
    C --> G(Limited Impact, Minor FOCI)
    D --> G
    E --> H(Moderate to Significant FOCI)
    F --> I(Highest Risk / Full Mitigation Required)

A Board Resolution is the lightest touch: the foreign investor agrees to certain limitations on access to classified information and board-level decisions. A Security Control Agreement (SCA) goes further, requiring a Government Security Committee with cleared U.S. citizens and DCSA oversight. A Special Security Agreement (SSA) is more involved still. A Proxy Agreement or Voting Trust effectively removes the foreign investor's voting rights and management influence entirely, which tends to make those investors very unhappy.

Each step up that chain adds time, legal complexity, and friction with investors who didn't know this was coming.

Why Investors Keep Getting Surprised

Venture funds with international LPs face a specific exposure here that isn't always flagged during fund formation. A fund may not itself be foreign, but if a foreign government or state-owned entity holds a meaningful LP stake, DCSA can trace that influence through the fund structure to the portfolio company. The two-hop problem is real.

This isn't theoretical. Several well-capitalized defense tech startups have had FCL applications delayed or denied because an early investor's LP structure included a foreign sovereign component that nobody bothered to disclose. The founders weren't being deceptive; they simply didn't know to ask.

Good defense-focused legal counsel does FOCI pre-flight before a term sheet closes. Most generalist startup attorneys don't even know what DCSA stands for.

What Founders Should Do Before They Raise

Start by mapping every potential investor against FOCI exposure before you accept a term sheet. Ask prospective investors directly about their LP composition and any foreign beneficial owners. Build a cap table policy early that defines acceptable investor profiles for FCL purposes. If you're targeting classified programs down the road, that policy should exclude foreign government LPs, foreign nationals in control positions, and investors from countries on DCSA's watch list.

Do this work before you're under term sheet pressure. Turning down a check mid-process because a strategic investor has a Singaporean sovereign LP creates much more damage than having a firm policy from day one.

Hire FOCI counsel before you need an FCL. A qualified national security attorney can review your cap table and flag exposure in a few hours. That's a trivial cost against the alternative.

Finally, build your board and executive team with FCL requirements in mind. Key Management Personnel (KMPs), including your CEO, CFO, and anyone with access to classified programs, will need to be U.S. citizens with the ability to hold clearances. Foreign nationals in those seats, even temporarily, can block or complicate your FCL.

The Opportunity Hidden in This Complexity

Here's what the FOCI problem actually signals: companies that build clean cap tables from the start, with U.S.-only or properly vetted institutional investors, carry a meaningful competitive advantage in the classified contract market. DCSA approval timelines have been running 12 to 18 months for contested cases. Startups that never trigger FOCI review can move faster than competitors who raised carelessly.

That's a real moat. Build it intentionally.